Actors

An actor is WebDecoy’s persistent identity for an automated client. Instead of treating every detection as an isolated event tied to an IP address, WebDecoy correlates detections into actors — so a bot that rotates through dozens of IP addresses shows up as one adversary with one history, not dozens of unrelated events.

Why actors exist

IP addresses are the weakest possible identity for a bot. Scrapers and attack tools rotate through datacenter ranges and residential proxy pools, and every new address resets an IP-based counter or block. Actors solve this by keying identity to what doesn’t change when the address does.

How an actor is identified

Each actor is keyed by a composite fingerprint built from signals captured across every detection:

• Network signals — the JA4 TLS fingerprint captured from the client’s actual TLS handshake, plus request characteristics. These work even for bots that never execute JavaScript.
• Device signals — browser characteristics collected by Detection Scripts where they’re installed.
• Cryptographic identity — for clients that present a verifiable signed identity (e.g. HTTP message signatures from AI agents), the signature issuer becomes the strongest identity tier of all.

A correlation worker continuously joins new detections to existing actors using the strongest signals available. When the same fingerprint appears from multiple IP addresses, those observations all fold into the same actor record.

Rotation is itself a signal

A fingerprint appearing from many IP addresses in a short window is one of the highest-confidence indicators of automation there is. WebDecoy tracks each actor’s distinct IP count and escalates its threat score as rotation increases — the evasion behavior becomes the evidence.

The Actors screen

Click Actors in the sidebar to see every tracked actor for your organization. The list shows each actor’s:

Column	Meaning
Threat	The actor’s aggregate threat score across all its detections
Tier	Which identity tier the actor is keyed by (network, device, or crypto)
Identity	The actor’s fingerprint identity
IPs	How many distinct IP addresses the actor has been seen from
Properties	Which of your properties the actor has touched
Detections	Total detections attributed to the actor
Last seen	Most recent activity

Actor detail

Click any actor to open its detail page:

• Fingerprint — the composite identity the actor is keyed by.
• Enforcement — the actor’s current enforcement state (see Response Actions).
• Cross-IP footprint — every IP address and user agent the actor has used, with observation counts and last-seen times. This is where rotation becomes visible: one fingerprint, many addresses.
• Recent detections — the individual detections attributed to this actor, each linking to its full detection detail.

When an actor is “rotating”

An actor qualifies as a confirmed rotating actor once it has been caught from 5 or more distinct IP addresses with an aggregate threat score of 60 or higher. Low-threat multi-IP traffic (a corporate network sharing one fingerprint, for example) never qualifies — the gate counts adversaries, not shared connections. The dashboard’s actor row tracks how many rotating actors are Ready to block (safe to enforce but not yet armed) versus Armed on your WAF (blocking rule live).

Actors and enforcement

Because the actor — not the IP — is the unit of identity, it’s also the unit of enforcement. A Response Action triggered by a confirmed rotating actor can push a fingerprint rule to your AWS WAF that applies to the actor across every IP it rotates through, not just the last address you happened to see.

For browser-grade actors, the actor detail page also carries session clearance deny controls: Deny actor puts the actor’s device fingerprint on the clearance deny-list so it can’t mint a clearance token on any IP, and Remove deny reverses it. A decoy hit applies the same denial automatically.

API access

Actors are available programmatically:

GET /api/organizations/{organization_id}/actors
GET /api/organizations/{organization_id}/actors/stats
GET /api/organizations/{organization_id}/actors/{actor_id}

See API Keys for authentication.

---

Next Steps

• Response Actions — automate enforcement against actors
• AWS WAF Integration — where actor-level blocking lands
• Threat Scoring — how detection scores roll up